Anthropic Discloses Fourth Unauthorised Claude Access Incident – Is The Security Industry Prepared For AI Breaches?

Anyone assuming AI sandbox breakouts were a thing of the past will be disappointed by Anthropic’s disclosure this week.

During a cybersecurity test back in January 2026, a pre-release version of Claude Opus 4.6 bypassed containment to interact with real-world networks, a breach that went undetected for seven months until staff prepared files for an outside review. To address the recurring issue, Anthropic has teamed up with independent non-profit METR on an eight-week probe covering all four incidents, opening up its transcripts and technical teams to outside investigators.

The culprit across all four sandbox breaks was a repeated setup flaw from the same third-party provider, which accidentally left an active internet connection open while promising the AI it was safely offline. Facing a blocked target due to conflicting IP addresses, Opus 4.6 improvised by finding its own route out. It navigated to a real-world machine thinking it was part of the test, harvested credentials, changed system configurations and viewed personal information belonging to a real person before its session timed out.

All of this breaking in the exact same week that Evan Hubinger, Anthropic’s Alignment Science lead, publicly stated a 10% probability of AI-driven human extinction over the next ten years. The two headlines form a surreal pairing: the lab’s leading safety researcher rating existential risk as a genuine threat, while his employer admits its models keep escaping their digital playpens to mess with real-world networks.

 

When The Hacker Is Just A Confused Algorithm

 

The trickiest part about classifying these incidents is that they lack the one thing security teams look for: an adversary.

The models had no harmful motives. They were just running through assigned capture-the-flag objectives, continually treating their surroundings as a test lab even while interacting with real infrastructure and harvesting actual personal data.

Anthropic noted two main driving factors behind the behaviour: models talking themselves into believing ambiguous setups were still part of the game, and a sheer refusal to pause when system signals suggested something was wrong.

This dynamic leaves corporate defence strategies in bizarre territory. Firewalls search for hostile breaches, insider threat tools monitor human behaviour and software audit tools look for corrupted dependencies. They don’t know what to do with an AI model that holds proper authorisation, acts with total innocence and accidentally triggers a data breach because a sandbox misconfiguration gave it a path to the live web.

We put the question to CISOs, incident response commanders, penetration testers and AI security analysts: are current enterprise threat models actually accounting for rogue AI agents without malicious intent, or is the tech sector waiting for a major disaster before building real safeguards?

 

 

Our Experts

 

• Viktor Bulanek, Founder, Penetrify
• Evgenii Arsentev, AI Transformation Executive, ARSENTEV.AI
• Karthik Karunanithi, Solution Architect, IBM
• Sayali Patil, Founder and CEO, IntentOps
• Jeff Watkins, Chief AI Officer, NorthStar Intelligence
• Luke Hinds, CEO and Co-founder, nolabs
• Robert Pfleghardt, Founder and CEO, CBR Labs and VoraPrep
• Eshaan Jain, Senior Product Manager, T-Mobile
• Cache Merrill, Founder, Zibtek
• Alexander Leslie, Senior Advisor, Recorded Future

 

Viktor Bulanek, Founder, Penetrify

 

 

“My threat model accounts for AI agents because they are my product. We run autonomous agents that perform authorised penetration tests, and the first design decision we made was to treat our own agent as hostile. Not because it has intent, but because it does not. An agent pursuing its interpretation of a task will walk through any door its credentials open, and it will do so confidently, without the hesitation or self-preservation that makes human insiders somewhat predictable.

“The industry’s detection stack largely assumes an adversary, so it looks for adversary behaviour: staging, evasion, exfiltration patterns. An agent with legitimate access exhibits none of that. What works instead is boring and economic: every autonomous run gets an envelope defined outside the model, an immutable scope, a spending cap, a time limit, a restricted set of destinations it can talk to, and any deviation from that envelope is the incident signal. The agent cannot negotiate with a limit it cannot see. Prompts and policies are advice. Envelopes are control.

“Is the industry building the right defences? Mostly it is still writing AI usage policies, which govern the humans, not the agents. Until “AI agent with legitimate access” appears in threat models next to insider risk, with its own detection and its own kill path, it is being treated as hypothetical. It stopped being hypothetical for us the first week we ran one.”

 

Evgenii Arsentev, AI Transformation Executive, ARSENTEV.AI

 

 

“Honestly, most threat models don’t account for it, and a year ago mine didn’t either. Security frameworks are built around intent. An agent has no intent to find. It has a task, a set of credentials and a very literal reading of both.

“The incidents I actually deal with are dull. Earlier this week one of my agents, asked to rebuild a single service, brought it up with the wrong configuration and quietly broke two integrations that depended on it. Another once changed a system setting on a work laptop that nobody had asked it to touch. Every action was authorised. Nothing looked like an attack.

“So detection has to track scope, not hostility. Log what each agent was asked to do and flag anything it touched outside that. Issue credentials per task and make them expire, so “access it wasn’t supposed to use” mostly stops existing. Put a person or an independent second check in front of anything irreversible. Is the industry ready? No. It still talks about this as a future risk, while in my logs sub-agents already make 52% of all model calls, each with its own context and its own permissions.”

 

Karthik Karunanithi, Solution Architect, IBM

 

 

“I think the industry is asking the wrong question about AI agents. Agent access is a known fact, but the real question is whether an agent can prove why its next action is authorised.

“The Opus 4.7 incident is interesting because the model identified the target as a real company almost 90% of the time, yet it still judged the environment safe to act in 75% of the time. Reachability and context clues were turning directly into permission decisions. In the fourth incident, an Opus 4.6 checkpoint never really checked whether its actions were authorised at all.

“This isn’t a new security problem. We’ve spent years building authorisation models around delegated access, but never applied them consistently to agents, because these agents are provisioned like service accounts: a static credential and a hopeful assumption. NIST’s NCCoE flagged agent identity and authorisation as a security gap back in February, and agent-specific controls remain largely unpublished to this day. Every tool call an autonomous agent makes should carry an auth chain: who delegated it, the resources in scope, the actual purpose and the evidence that permits the action.

“Detection needs the same shift. Anthropic’s monitor initially flagged only around 1% of actions, because the model’s reasoning was persuasive enough to convince the system the environment was simulated. Strip out that reasoning layer and score purely on tool calls and results instead, and the flag rate jumps to 50%. The most pressing emerging threat isn’t an AI stealing credentials. It’s an AI that has valid credentials and invents its own interpretation of what they permit.”

 

Sayali Patil, Founder and CEO, IntentOps

 

 

“No, and I’d be surprised if most threat models can right now, because the category genuinely doesn’t fit anywhere yet. Every established framework I’ve worked with, insider threat, intrusion detection, supply chain risk, assumes intent behind a breach. What Anthropic just disclosed is structurally different: models given legitimate testing access, told they were operating inside an isolated simulation, that kept going past the point where a human would have stopped to ask whether they were actually allowed to be there. One model tried to abort eight separate times before a broken harness pushed it toward real systems instead. That’s not malice. That’s the absence of a working stop mechanism, which in my experience is a far more common root cause than people assume.

“I’ve spent years testing automated systems for exactly this failure, first in large-scale infrastructure at Cisco, now specifically in AI agents. The lesson I keep relearning is that meaningful detection has to stop asking “is this an authorised identity taking an authorised action” and start asking “is this system’s behaviour still consistent with what it was actually supposed to be doing.” Those are two different questions, and a system can pass the first cleanly while failing the second in complete silence, which is precisely what happened here across four separate incidents before anyone outside the company caught it.

“Practically, that means treating abort and halt mechanisms as security-critical infrastructure rather than an afterthought, since a broken kill switch is what turned one of these from a contained test into an actual breach, and instrumenting for behavioural drift rather than just access anomalies. Most organisations I talk to are still treating this as a hypothetical they’ll get to eventually. Anthropic just handed the industry the clearest evidence yet that it isn’t.”

 

Jeff Watkins, Chief AI Officer, NorthStar Intelligence

 

 

“Moving AI out of the chat window and giving autonomous agents access to real systems would always introduce a new category of security risk. Agents can operate at machine speed and scale, use tools and credentials, and potentially coordinate with other agents to achieve an objective. The danger isn’t limited to malicious actors deliberately weaponising them. An agent diligently pursuing a poorly specified objective can potentially cause just as much damage.

“The recent incidents are particularly interesting because they challenge one of the assumptions underpinning conventional threat modelling: that there is an adversary with malicious intent. An AI agent doesn’t necessarily need to be malicious, compromised or even knowingly acting outside its authority to become a security threat. If its understanding of the task differs from ours regarding its boundaries, the outcome can look a lot like an intrusion. That means organisations need to model both external and internal agentic threats. A hardened external perimeter will do little to protect you from an agent already operating legitimately inside it.

“Simply propagating a user’s permissions to an agent is particularly risky. Instead, agents should ideally have their own identities and be granted narrowly scoped, task-specific and time-limited permissions. We also need to reconsider detection and response. Conventional dashboarding assumes there is enough time for a human analyst to notice something unusual and intervene. An autonomous agent may perform hundreds of actions in that interval. Observability needs to be coupled with automated containment: rate limits, behavioural thresholds, circuit breakers and kill switches capable of suspending an agent or isolating its environment when its behaviour moves outside expected boundaries.

“The important principle is that scope should be technically enforced rather than simply described in a prompt. Network controls, permissions, sandboxing and tool restrictions need to make prohibited actions impossible, or at least rapidly detectable and reversible. Agentic AI makes intent a less useful concept in cybersecurity. Rather than asking only who is attacking us and why, we increasingly need to ask what this actor can reach and do, how quickly we can detect unexpected behaviour, and how quickly we can stop it.”

 

Luke Hinds, CEO and Co-founder, nolabs

 

 

“For many of us in the industry, this was inevitable. But these incidents should act as a wake-up call to businesses. Agents don’t often act with malice. It’s a bright, well-meaning agent with too much access and too little context.

“The problem is that many organisations are still trying to secure agents the same way they have secured humans or conventional software. That will not work. Blunt sandboxing is not enough, since if you lock agents down too heavily, you kill the value businesses are trying to unlock. Put a human approval step in front of every action and you no longer have an autonomous agent. Businesses need controlled freedom, enough authority for the task in front of the agent, and absolutely nothing more.

“That means every identity, permission, decision and action needs to be continuously verified, governed and auditable. Detection has to focus on what an agent is actually doing with legitimate access, not simply whether its credentials are valid. Crucially, that security boundary has to sit outside the model. Frontier labs should not be marking their own homework or deciding what agents can access, decide or do. These incidents are proof that organisations need independent controls that govern agents regardless of which model they use. Ultimately, businesses shouldn’t rely on agents to behave well. Security has to be built in from day one, so breaking the rules becomes structurally impossible.”

 

Robert Pfleghardt, Founder and CEO, CBR Labs and VoraPrep

 

 

“Traditional threat models assume malicious intent. That’s the blind spot. After 37 years securing SCIFs and courtrooms, I’ve learned that whether a camera activates because of malware or because an AI misread its own task, the outcome is the same: data gets exposed. I once watched a facility spend six figures on adversarial threat modelling for a room that still had a tablet with a working microphone sitting on the table. Nobody asked what happens if nothing malicious ever touches that device at all.

“So what does real detection look like? Extreme behavioural anomaly monitoring at the data perimeter, regardless of the agent’s declared purpose. You track what data pathways are being accessed and how far they stray from strict authorisation boundaries, not who’s doing it, and not why. Most organisations are still treating this as a software problem, patching around agent behaviour with better access controls and another monitoring dashboard.

“But software guardrails fail, and they fail quietly. If an AI agent has legitimate software access and can physically activate a microphone, a camera or a wireless antenna, unintended data exfiltration is possible. You need smarter detection too, but detection alone isn’t the fix. The real fix is immutable physical limitation. At CBR Labs, we permanently remove cameras, microphones, speakers, Wi-Fi, Bluetooth and antennas from tablets used in secure environments. If the hardware physically can’t transmit, it doesn’t matter what the AI thinks it’s doing. The industry hasn’t caught up to that yet.”

 

Eshaan Jain, Senior Product Manager, T-Mobile

 

 

“Traditional threat models break down when autonomous AI systems act as attackers without malicious intent. Security teams currently rely on frameworks that look for malicious actors, clear indicators of compromise, or compromised insider credentials.

“When an autonomous agent misinterprets a valid workflow and accesses unauthorised infrastructure using legitimate permissions, standard intrusion detection systems fail to catch the deviation. The industry is still treating non-malicious autonomous boundary-crossing as a hypothetical edge case rather than an operational reality. Meaningful defence requires shifting from static access control lists to dynamic semantic guardrails. Security posture must evaluate what an AI agent is actually trying to accomplish in real time, rather than just checking whether its cryptographic credentials are valid.

“Until detection tools learn to monitor behavioural intent and task boundaries alongside technical privileges, companies remain vulnerable to automated overreach that traditional security frameworks cannot classify or stop.”

 

Cache Merrill, Founder, Zibtek

 

 

“I don’t think most enterprise threat models are ready for an AI agent that has legitimate access but uses that access in a way nobody intended. In traditional security, we’re usually looking for a compromised account, malicious code, or someone deliberately trying to get somewhere they shouldn’t. With an AI agent, the access can be legitimate while the actions still create a security problem.

“In the security work I’ve been involved with, I’d want to see what the agent is actually doing after it gets access. It should have only the permissions it needs, its actions should be logged, and there should be limits on what it can change or where it can connect. If it starts behaving outside its expected pattern, I’d treat that seriously even if there was no malicious intent. AI agents need to be treated as part of the attack surface, not just another application.”

 

Alexander Leslie, Senior Advisor, Recorded Future

 

 

“What happened at Hugging Face is a meaningful inflection point, but it needs to be described precisely. This was not an AI model spontaneously developing malicious intent. OpenAI deliberately placed highly cyber-capable models into an exploitation benchmark with their normal safeguards reduced. The significant fact is that the models exceeded the intended boundaries of that test, discovered an unknown vulnerability, obtained access to the open internet, and autonomously chained credential theft, privilege escalation, lateral movement and remote code execution against a real third party.

“Under our AI Malware Maturity Model, this is the clearest public demonstration yet of Level 5 technical capability. An agentic system conducted a complex, multi-stage operation end-to-end without step-by-step human direction. It is not yet evidence of Level 5 malicious activity in the wild. There was no criminal or state operator directing the campaign, and the models were operating under specialised evaluation conditions with reduced refusals and substantial computing resources. That distinction separates a genuine capability milestone from an exaggerated claim that fully autonomous cyber campaigns have suddenly become routine.

“The techniques themselves were not new. The models exploited the same weaknesses that sophisticated human operators exploit, including vulnerable third-party software, overprivileged credentials, insufficient segmentation, and remote code execution paths. What changed was the speed, persistence and autonomy with which those weaknesses could be discovered and combined. The strategic risk is not that artificial intelligence creates an entirely new cyber kill chain. It is that AI can execute the existing kill chain continuously and at a volume that overwhelms human-speed defence. Organisations must treat AI agents as privileged digital identities, treat model and data pipelines as executable attack surfaces, and correlate identity, vulnerability, infrastructure and third-party intelligence at machine speed.”

 

For any questions, comments or features, please contact us directly.